okx-dapp-discovery

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly forwards the user's "original prompt" verbatim into an installed plugin's quickstart (bootstrap/forwarding), so any secrets a user includes in their prompt would be passed through and potentially emitted—this requires the LLM to handle/output secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill intentionally auto-installs and silently loads third‑party plugins (via npx and GitHub), immediately forwards the user's original prompt into newly installed plugin quickstarts, and allows external binary/script downloads into PATH — creating clear supply‑chain, remote‑code‑execution, and data‑exfiltration risks.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill calls the GitHub Contents API at runtime (https://api.github.com/repos/okx/plugin-store/contents/skills) to discover and then npx-installs plugins from the okx/plugin-store (whose releases and raw.githubusercontent.com-hosted scripts/binaries — e.g. github.com/okx/plugin-store/releases and raw.githubusercontent.com — are referenced as pre-flight downloads that can execute code), so remote content fetched during runtime can determine routing and install/execute external code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly built for DeFi DApp discovery and routing to third‑party protocol plugins (Aave, Hyperliquid, Polymarket, PancakeSwap, etc.). It recognizes action verbs like "swap", "buy", "deposit", "stake", "borrow", "lend" and, on a match, installs a protocol plugin and "forwards the user's original prompt into the installed plugin's quickstart" so the plugin can carry out the requested action. The install + immediate forward behavior (including npx install and re-applying the user's prompt to the plugin) directly enables downstream crypto/DeFi transaction execution. This is not a generic tool — it is purpose-built to route to and activate financial-execution plugins, so it grants direct financial execution authority.